
United States Patent and Trademark Office 




UNITED STATES DEPARTMENT OF COMMERCE 
United States Patent and Trademark Office 
Address: COMMISSIONER FOR PATENTS 
P.O. Box 1450 

Alexandria, Virginia 223 1 3- 1 450 
www.uspto.gov 



APPLICATION NO. 



FILING DATE 



FIRST NAMED INVENTOR 



ATTORNEY DOCKET NO. 



CONFIRMATION NO. 



09/620,350 



35525 



07/20/2000 



7590 09/21/2005 

IBM CORP (YA) 
C/0 YEE & ASSOCIATES PC 
P.O. BOX 802333 
DALLAS, TX 75380 



William J Reid 



AUS990912US1 



3424 



EXAMINER 



HO, THOMAS M 



ART UNIT 



PAPER NUMBER 



2134 

DATE MAILED: 09/21/2005 



Please find below and/or attached an Office communication concerning this application or proceeding. 



PTO-90C (Rev. 10/03) 



; 

Office Action SummBtv 


Application No. 

09/620.350 


Applicant(s) 

REID. WILLIAM J 


Examiner 

Thomas M. Ho 


Art Unit 

2134 





The MAILING DATE of this communication appears on the cover sheet with the correspondence address 



Period for Reply 

A SHORTENED STATUTORY PERIOD FOR REPLY IS SET TO EXPIRE 3 MONTH(S) OR THIRTY (30) DAYS, 
WHICHEVER IS LONGER, FROM THE MAILING DATE OF THIS COMMUNICATION. 

- Extensions of time may be available under the provisions of 37 CFR 1 .136(a). In no event, however, may a reply be timely filed 
after SIX (6) MONTHS from the mailing date of this communication. 

- If NO period for reply is specified above, the maximum statutory period will apply and will expire SIX (6) MONTHS from the mailing date of this communication. 

- Failure to reply within the set or extended period for reply will, by statute, cause the application to become ABANDONED (35 U.S.C. § 133). 
Any reply received by the Office later than three months after the mailing date of this communication, even if timely filed, may reduce any 
earned patent term adjustment. See 37 CFR 1.704(b). 

Status 

1 )K Responsive to communication(s) filed on 24 June 2005 . 
2a)n This action is FINAL. 2b)^ This action is non-final. 

3) 0 Since this application is in condition for allowance except for fornnal nnatters, prosecution as to the merits is 

closed in accordance with the practice under Ex parte Quayle, 1935 CD. 1 1 , 453 O.G. 213. 

Disposition of Claims 

4) S Claim(s) 1-3,5-1 4,1 6-24,26-38 and 40 is/are pending in the application. 

4a) Of the above claim(s) is/are withdrawn from consideration. 

5) ^ Claim(s) 5,16 and 26 is/are allowed. 

6) |EI Claim(s) 1-3,6-14,17-24.27-38 and 40 is/are rejected. 

Claim(s) is/are objected to. 

8) 0 Claim(s) are subject to restriction and/or election requirement. 

Application Papers 

9) 0 The specification is objected to by the Examiner. 

10) n The drawing(s) filed on is/are: a)n accepted or b)n objected to by the Examiner. 

Applicant may not request that any objection to the drawing{s) be held in abeyance. See 37 CFR 1 .85(a). 
Replacement drawing sheet{s) including the correction is required if the drawlng(s) is objected to. See 37 CFR 1.121(d). 

1 1) 0 The oath or declaration is objected to by the Examiner. Note the attached Office Action or form PTO-152. 

Priority under 35 U.S.C. § 119 

12) 0 Acknowledgment is made of a claim for foreign priority under 35 U.S.C. § 1 19(a)-(d) or (f). 
a)n All b)n Some * c)^ None of: 

1 .□ Certified copies of the priority documents have been received. 

2. n Certified copies of the priority documents have been received in Application No. . 

3. n Copies of the certified copies of the priority documents have been received in this National Stage 

application from the International Bureau (PCT Rule 17.2(a)). 
* See the attached detailed Office action for a list of the certified copies not received. 



Attach ment(s) 

1) □ Notice of References Cited (PTO-892) 

2) CD Notice of Draftsperson's Patent Drawing Review (PTO-948) 

3) □ Information Disclosure Statement(s) (PTO-1449 or PTO/SB/08) 

Paper No(s)/Mail Date . 



4) □ Interview Summary (PTO-413) 

Paper No(s)/Mail Date. . 

5) □ Notice of Informal Patent Application (PTO-152) 

6) □ Other: . 



U.S. Patent and Trademark Office 
PTOL-326 (Rev. 7-05) 



Office Action Summary 



Part of Paper No./Mail Date 091705 



Application/Control Number: 09/620,350 
Art Unit: 2134 



Page 2 



DETAILED ACTION 

1. Claims 1-3, 5-14, 16-24, 26^38, 40 are pending. 

Response to Arguments 

2. The Examiner has fully considered Applicant's previous arguments, but they are moot in 
view of the new grounds of rejection. 

As a clarifying measure, the Examiner notes that Applicant has argued the following on page 13 
2"*^ and 3'"* paragraphs. The Examiner will elucidate his position and address applicant's 
arguments. 

''Initially, Applicant is unable to find any specific disclosure in Gannon specifically describing 
any ''security parameter lists that are updated. Furthermore, even if security parameter lists 
are, in some way updated in Gannon, there is clearly no teaching or suggestion in the reference 
of "updating security parameter lists associated with at least one of files and resources 
associated with each of the plurality of servers " 

Specifically, even if Gannon can be construed as teaching updating a list of virus definitions, 
such a list would not be "associated with at least one or files or resources associated with each 
of the plurality of servers as required by claim 1. 
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Gannon, discloses the usage of the Norton Antivirus software, which releases a virus definition 
file. Applicant appears to suggest that such a Hst of virus definition is at least not one of 

1) a security parameter list 

2) associated with at least one of files and resources associated with the plurality of servers. 

It is the Examiner position however, that a security parameter list, is merely a list of security 
parameters. A parameter as understood in the art is broadly understood to be a piece of data, any 
data, that is used for a particular fimction. For Example, MULT(3, 4) has the parameters 3 and 
4, that the function MULT will somehow use or employ. Li the same manner, the Ust of virus 
definitions serves as a parameter for the Norton antivirus software, which makes use of the 
definition file so that it now knows to search for new variations or binary strings which may be 
indicative of a virus. Without fiirther definition, a parameter list may be broadly construed as 
ANY piece of data, so long as it is used for security purposes. 

Secondly, it is the Examiner's position that an association between two entities is merely some 
demonstrated relationship between them. Associations are intangible. As Dictionary.com 
recites, it is: 

a. A mental connection or relation between thoughts, feelings, ideas, or sensations. 

b. A remembered or imagined feeling, emotion, idea, or sensation linked to a person, 
object, or idea. 

So long as a relationship, even if intangible, is able to be found between the virus definition list, 
and the "at least one of files and resources associated with the plurality of servers.", then such an 
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association which meets the claim can be said to exist. In the case of the virus definition Ust, 
there is a definite and unchanging association which dictates how the Norton Antivirus software 
uses it. The Ust of virus definitions is associated with at least one of the files associated with the 
plurality of servers in that each server has a "virus definition file". The new list that comes about 
by updating it, is merely replacing the old virus definition file associated with that server. The 
new list can also be said to be associated with the resources of that server. The vital data that the 
server stores will be protected once the new virus definition data file is used by Norton. Hence, 
the association is "using the list as a parameter for protection of the server's data". 

3. Claim 5, 16, 26 are allowable. 

Claim Rejections - 35 USC §103 

4. The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set forth in 
section 102 of this title, if the differences between the subject matter sought to be patented and the prior art are 
such that the subject matter as a whole would have been obvious at the time the invention was made to a person 
having ordinary skill in the art to which said subject matter pertains. Patentability shall not be negatived by the 
manner in which the invention was made. 

5. Claims 1-3, 6-14, 17-24, 27-38, 40 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over "Gannon University Norton Antivirus Configuration" and "Windows NT 
server 4.0". 
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In reference to claim 1 : 

"Gannon University Norton Antivirus Configuration" discloses a method of updating security 
configurations of a plurality of servers, comprising: 

• Changing security information in a centralized server, where the security information 
changed is the virus definition file which the user will download, and the centralized 
server is the site the antivirus program dovraloads the virus definition from. Gannon 
(page 1, figure in the middle, virus definitions dated 9/22/1999) 

• Receiving an update command, where the update command is received through 
liveupdate to update the virus definition file. Gannon (page 3, figure at the top) 

i 

• Downloading the changed security information to the plurality of servers in response to 
receiving the update command, wherein the downloaded changed security information is 
used to update the security configurations of the plurality of servers, where the changed 
security information is the new virus definition file and is downloaded to a plurality of 
servers in response to receiving the update command. Gannon (page 5, Item 5) 



• "Gannon University Norton Antivirus Configuration" (page 1, figure 1, "using virus 
definitions dated 9/22/1999) and "Windows NT server 4.0" discloses the method of claim 
1, wherein the security configurations of the plurality of servers are updated by updating 
security parameter lists associated with at least one of files and resources associated with 
each of the plurality of servers, where the security configuration is the configuration for 
virus files, where the plurality of servers are the multiple clients using Norton antivirus 
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running on windows NT server, and the security parameters are virus definitions, and the 
security parameter list is the list of virus definitions contained inherently contained in the 
virus definition file. 

The reasons for the combination of "Gannon University Norton Antivirus Configuration" with 
windows NT servers is as set forth in the previous rejection's claim 2 below. 

hi reference to claim 2: 

"Gannon University Norton Antivirus Configuration" fails to explicitly disclose the method of 
claim 1, wherein the plurahty of servers are windows NT servers and the centrahzed server is a 
directory server. 

"Gannon University Norton Antivirus Configuration" however does teach that Norton is 
compatible with a computer running windows NT. (Bottom of page 1) "Gannon University 
Norton Antivirus Configuration" also teaches that clients using Norton has the ability to check 
for virus updates from a centralized server. 

Norton Antivirus(Page 1) teaches that windows NT servers may be used as the platform on 
which to run Norton. (This is meant as a reference to clarify details regarding the use Norton 
Antivirus and is not used in the 103 combination) 
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"Gannon University Norton Antivirus Configuration" also does not teach if the centralized server 
is a directory server or not. 

The Examiner takes official notice that using Windows NT server was well known at the time of 
invention as it was a widely available commercial product. 

Windows NT server 4.0 (page 197) discloses that windows NT server may also act as a directory 
server. 

It would have been obvious to one of ordinary skill in the art at the time of invention to have 
each client of Norton Antivirus run on Windows NT server and to have the centralized 
liveupdate server run Windows NT server 4.0 within which directory server functions are 
performed in order to allow for greater compatibility between the clients (running windows NT 
server) and the centralized server (rurming windows NT server). 

In reference to claim 3: 

Windows NT server 4.0 (page 199, figure 7.12) discloses method of claim 1, wherein the 
centralized server is a directory server and wherein changing the security information includes 
using an editor to change a directory listing in the centralized server. 



In reference to claim 6: 
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"Gannon University Norton Antivirus Configuration" fails to disclose the method of claim 1, 
wherein the update command is received from a network administrator. 

A network administrator is merely a person, another user whose function it is to perform network 
administration tasks. The occupation of the cHent running Norton Antivirus can be anyone: a 
banker, a student, a lawyer, or a painter or anyone that wishes to use Norton Antivirus. 

"Gannon University Norton Antivirus Configuration" (page 3) discloses the person who sends 
the update command is whoever is using the software at the time. 

It would have been obvious to one of ordinary skill in the art at the time of invention for a 
network administrator to send the update command in order for the network administrator to 
perform his or her job duties of providing security for the network. 

In reference to claim 7: 

"Gannon University Norton Antivirus Configuration" (page 3) discloses the method of claim 1, 
wherein the update command is received at scheduled periodic times. 

In reference to claim 8: 

"Gaimon University Norton Antivirus Configuration"(page 3) and "Windows NT server 4.0" 
discloses method of claim 1 , wherein the update command is received from one or more of the 
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plurality of servers, where the update command is received from a user rumiing Norton antivirus 
on windov^s NT server. 

In reference to claim 9: 

"Gannon University Norton Antivirus Configuration" and "Windov^s NT server 4.0" fails to 
disclose a method w^herein the centralized server is a Hght weight directory access protocol 
server. 

The examiner takes official notice that the lightweight directory access protocol, or 
LDAP is well known to those of ordinary skill in the art. LDAP defines a standard manner of 
organizing directory hierarchies and a standard interface for clients to interface with access 
directory servers. 

It would have been obvious to one of ordinary skill in the art to use the lightweight 
directory access protocol in the central server because LDAP has broad industry support, and 
runs directly over TCP/IP. 

In reference to claim 10: 

"Gannon University Norton Antivirus Configuration" discloses the method of claim 1, wherein 
downloading the changed security information includes filtering a directory listing stored on the 
centralized server to extract the changed security information, where the filtering of a directory 
listing to extract the security information is inherent. 
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Norton Antivirus downloads a virus definition file from a centralized server. The centralized 
server, owned by Symantec systems periodically updates to create new virus definition files. It 
is inherent that the virus definition file that the client download be located in a directory structure 
of some kind. For example: 
C:\my documents\new files\virus_updates.dat 

To access this file, a directory listing is inherently filtered through to access that file, 
hi reference to claim 1 1 : 

"Gannon University Norton Antivirus Configuration" discloses the method of claim 1, wherein 
the security configurations are updated by filtering the downloaded changed security information 
to extract only necessary update information for updating the security configurations and then 
updating the security configurations based on the extracted necessary update information, where 
the information necessary to update the security information taken is the virus definition file and 
the updating process once the file has been downloaded is inherent to Norton Antivirus. 

hi reference to claim 32: 

"Gannon University Norton Antivirus Configuration" & "Norton Antivirus 5.0 for Windows NT 
Servers" discloses method in a data processing system for updating access information for a 
plurality of servers, the method comprising: 
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• Collecting changes to access information at the data processing system to form modified 
access information, where the access information is virus definition information which is 
accessed from the central server, and the changes are collected to form a newly updated 
set of virus identification collected by antivirus research center. "Ganon Norton 
Antivirus 5.0 for Windows NT Servers" page 4-5 

• Responsive to a policy, transferring the modified access information to the plurality of 
servers, wherein the modified access information is used to update the security 
configurations of the plurality of servers, where the poUcy is simply a rule dictating when 
the transfer of data or the update is to take place. "Gannon University Norton Antivirus 
Configuration" (page 3), and where the access information, the virus definition file, is 
transferred in update process. "Gannon University Norton Antivirus Configuration" 
(page 4), 

No motivation is required to combine, because it is understood that "Norton Antivirus 5.0 for 
Windows NT Servers" is a reference which provides more details as to the nature of Norton 
Antivirus, the use of which has already been disclosed by "Gannon University Norton Antivirus 
Configuration", and the combination with windows NT which has been established as set forth in 
the rejection of claim 2. 

Claims 13, 38 are rejected for the same reasons as claim 2. 
Claim 24 is rejected for the same reasons as claim 3. 
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Claims 17, 27 are rejected for the same reasons as claim 6. 
Claims 19, 29 are rejected for the same reasons as claim 8. 
Claims 20, 30 are rejected for the same reasons as claim 9. 
Claims 12, 23, 37 are rejected for the same reasons as claim 1 . 
Claims 18, 28, 34, 36 are rejected for the same reasons as claim 7. 
Claims 21,31 are rejected for the same reasons as claim 10. 
Claim 22 is rejected for the same reasons as claim 11. 



Conclusion 

6. Any inquiry concerning this communication from the examiner should be directed to 
Thomas M Ho whose telephone number is (571)272-3835. The examiner can normally be 
reached on M-F from 9:30 AM - 6:00 PM. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's supervisor, 
Gregory A. Morse can be reached on (571)272-3838. 

The Examiner may also be reached through email through Thomas.Ho6@uspto.gov 



Any inquiry of a general nature or relating to the status of this application or proceeding should 
be directed to the receptionist whose telephone number is (571)272-2100. 

General Information/Receptionist Telephone: 571-272-2100 Fax: 703-872-9306 , 
Customer Service Representative Telephone: 57 1 -272-2 1 00 Fax: 703-872-9306 





TMH ^REqpRY MORSE 

SUPERVISORY PATENT EXAMINER 
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